CVE-2026-21238: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-21238 Overview

CVE-2026-21238 is a local privilege escalation vulnerability affecting the Windows Ancillary Function Driver for WinSock (AFD.sys). This kernel-mode driver is a critical component of the Windows networking stack that handles Winsock operations and provides the interface between user-mode applications and the underlying transport protocols. The vulnerability stems from improper access control within the driver, allowing an authenticated attacker with low privileges to elevate their permissions to SYSTEM level on affected Windows systems.

Critical Impact

An attacker who successfully exploits this vulnerability could gain SYSTEM-level privileges on the target machine, enabling complete system compromise, persistence mechanisms installation, and lateral movement across enterprise networks.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) - x86, x64, and ARM64 architectures
• Microsoft Windows 11 (versions 23H2, 24H2, 25H2) - x64 and ARM64 architectures
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-02-10 - CVE-2026-21238 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21238

Vulnerability Analysis

The Windows Ancillary Function Driver for WinSock (afd.sys) is a fundamental kernel-mode driver that acts as the kernel interface for the Windows Sockets (Winsock) API. This driver processes I/O Request Packets (IRPs) from user-mode applications requesting network operations.

CVE-2026-21238 exploits improper access control (CWE-284) within the AFD driver's handling of certain operations. The vulnerability allows a locally authenticated user to bypass security checks and execute code with elevated kernel privileges. Because the AFD driver operates in kernel mode with SYSTEM privileges, successful exploitation grants the attacker complete control over the affected system.

The local attack vector means an attacker must first gain access to the target system, either through valid credentials, social engineering, or by chaining this vulnerability with a remote access vulnerability. Once local access is obtained, the privilege escalation can be achieved without any user interaction required.

Root Cause

The root cause of this vulnerability is classified as CWE-284 (Improper Access Control). The AFD driver fails to properly validate or restrict access to privileged operations, allowing a low-privileged user to invoke functionality that should be restricted to higher privilege levels. This type of flaw typically occurs when the driver does not adequately verify the caller's privileges before performing sensitive operations or when object permissions are incorrectly configured within the driver's internal data structures.

Attack Vector

The attack is executed locally by an authenticated user with low privileges. The attacker leverages the improper access control in the AFD driver to perform operations that elevate their process token to SYSTEM level.

The exploitation flow typically involves:

1. The attacker gains initial access to the system with standard user privileges
2. A malicious application or script interacts with the AFD driver through documented or undocumented IOCTL codes
3. Due to insufficient access control validation, the driver processes the request in a privileged context
4. The attacker's process gains SYSTEM-level privileges, bypassing all user-based access restrictions

For detailed technical information about the vulnerability mechanism, refer to the Microsoft Security Advisory.

Detection Methods for CVE-2026-21238

Indicators of Compromise

• Unusual process creation events with SYSTEM privileges originating from low-privileged user contexts
• Suspicious IOCTL calls to afd.sys from non-standard applications or processes
• Unexpected privilege token modifications in user-mode processes
• Memory manipulation patterns targeting the AFD driver's memory space

Detection Strategies

• Monitor for processes that unexpectedly acquire SYSTEM or SeDebugPrivilege tokens after starting with standard user privileges
• Implement Sysmon or equivalent logging to capture detailed driver interaction events, particularly focusing on network driver IOCTL communications
• Deploy behavioral detection rules that identify privilege escalation patterns characteristic of kernel driver exploitation
• Enable Windows Defender Exploit Guard to detect and block suspicious kernel memory access patterns

Monitoring Recommendations

• Configure Security Information and Event Management (SIEM) to correlate privilege escalation events with AFD driver activity
• Enable detailed kernel audit logging through Windows Event Tracing for Windows (ETW) to capture driver interaction anomalies
• Monitor for new service installations or scheduled tasks created immediately following suspicious AFD driver interactions
• Implement baseline monitoring for normal AFD driver usage patterns to identify anomalous behavior

How to Mitigate CVE-2026-21238

Immediate Actions Required

• Apply the latest Microsoft security updates as soon as they become available through Windows Update or WSUS
• Limit local access to systems by enforcing the principle of least privilege and reviewing local user accounts
• Enable Windows Defender Credential Guard and Hypervisor-protected Code Integrity (HVCI) where supported
• Implement application control policies to restrict execution of unauthorized binaries that could attempt exploitation

Patch Information

Microsoft has released security updates addressing this vulnerability. Organizations should consult the Microsoft Security Response Center Advisory for specific KB article numbers and patch versions applicable to each affected Windows version. The patches should be deployed through standard Windows Update channels, WSUS, or Microsoft Endpoint Configuration Manager for enterprise environments.

Workarounds

• Restrict local logon privileges to only authorized administrative personnel on critical systems
• Deploy network segmentation to limit potential lateral movement if a system is compromised
• Enable Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard mitigations on legacy systems
• Consider temporarily isolating critical systems from standard user access until patches can be applied

# Verify current Windows patch level
wmic qfe list brief /format:table

# Check if AFD driver is current (compare version after patching)
driverquery /v | findstr /i "afd"

# Enable auditing for privilege use events
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable